SECURITY004 — Xtrm Sub-processors
Last updated: September 1, 2026
To support Xtrm in delivering its services, Xtrm may engage third-party service providers to assist with its data processing activities. When we work with these service providers in our capacity as a data processor, the third-party service provider is a sub-processor of Xtrm ("sub-processor").
This page identifies each sub-processor, describes where they're located, and what services they provide to us. Before engaging any sub-processor, we perform extensive due diligence, including detailed security and legal analysis — we don't engage a sub-processor unless our quality standards are met. All our sub-processors are subject to contract terms that enforce compliance with applicable data protection laws.
Xtrm currently uses the following sub-processors:
Sub-processor | Service provided | Location |
|---|---|---|
Corpay Inc. (formerly Cambridge Mercantile Corp.) | Payment processing, settlement services, and fraud checking | United States of America |
Payment processing, settlement services, and fraud checking | United States of America | |
CheckIssuing | Check printing and mailing partner | United States of America |
Pylon Labs Inc. | User relationship management | United States of America |
HubSpot | User relationship management | United States of America |
Email, file storage | United States of America | |
Hyve | Hosting service provider | United States of America |
Tango Card | Virtual Visa/Mastercard and gift card processing, settlement services, and fraud checking | United States of America |
Bancorp | Rapid bank transfer | United States of America |
Credit and debit card processing | United States of America | |
Cloudflare | Security infrastructure | United States of America |
Chargebee | SaaS plan management | United States of America |
Cyphlens | Multi-factor authentication | United States of America |
Persona | Secure identity verification | United States of America |
Transaction monitoring | United States of America |
Our business needs may change from time to time — for example, we may deprecate a sub-processor to consolidate and minimize our use of sub-processors Privacy Policy.